react-hook-form-zod-shadcn
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides installation commands for several Node.js packages using version numbers that do not exist on the public npm registry. Specifically, it references
react-hook-form@7.71.1,zod@4.3.6, and@hookform/resolvers@5.2.2. These version numbers are significantly ahead of current stable releases (e.g., Zod is currently at v3.24.x, and React Hook Form is at v7.54.x). This 'version hallucination' creates a supply chain vulnerability where a malicious actor could register these specific version numbers on the public registry to distribute malware to unsuspecting users. - [COMMAND_EXECUTION]: The README and installation instructions recommend executing an
npxcommand that downloads and executes content from a remote GitHub repository (https://github.com/Sortweste/frontend-skills). While the repository is owned by the skill author, the pattern of fetching and executing remote scripts should always be performed with caution as it bypasses local review of the code being executed.
Recommendations
- AI detected serious security threats
Audit Metadata